how to configure /etc/syslog.conf for syslogd?

[smilie]

I need to just log *.alert and *.notice to a specific file. How to mask all messages from other levels,like *.crit *.err and *.warning?

[Jeff Machols]

*.alert /var/adm/syslog.syslog.log
*.notice /var/adm/syslog/syslog.log

[Jeff Machols]

oops forgot the rest

*.err /dev/null (or some file)
*.crit /var/adm/syslog/crit_errors

[Helen French]

Hi,

Try this:

1) Edit /etc/syslog.conf and add these lines.
*.alert /var/adm/syslog/syslog.log
*.notice /var/adm/syslog/syslog.log
*.err /var/adm/syslog/errors.log
*.crit /var/adm/syslog/crits.log
*.warning /var/adm/syslog/warnings.log

2) Make syslogd re-read the new conf file by using:

# kill -HUP `cat /var/run/syslog.pid`

HTH,
Shiju

[smilie]

I've tested your configuration and found it logged all alarms higher than notice level to that file, and all alarms of alert level show twice.

[Sanjay_6]

Hi smilie,

Use "man syslogd" for information on how to configure /etc/syslog.conf to suit your requirements.

Hope this helps.

Regds

[Helen French]

Hi,

You can exclude levels using level none.

For eg: *.info;mail.none - will select all messages except mail.

HTH,
Shiju

[smilie]

Jeff and Shiju ,

Thanks for you help. Your solution is getting closer to what I want.

If we configure a seperate logfile for each level, that would cause an alarm is duplicated into different logfile.

for example, if my facility is local1 and syslog.conf is below

local1.alarm /tmp/alarm
local1.warning /tmp/warning
local1.notice /tmp/notice

when new alarm on "notice level" is comming, it's supposed to be logged into /tmp/notice, /tmp/warning and /tmp/alarm.
That's not what I want.

Any more suggestions?